Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-54418

Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TuranSec

Description

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Leantime Leantime

Default version status: unknown

  • 0 to ≤ 3.6.2affected

References